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WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 
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DETAILED ACTION 

Response to Amendment 

This office action is in response to request for reconsideration filed on May 26, 2006. 
Original application contained Claims 1-30. Applicant previously amended Claimsl, 5, 10, 1 1, 
15, 21, and 25. Applicant currently amended Claims 5, and cancelled Claims 8, and 10. The 
amendment filed on May 26, 2006 have been entered and made of record. Presently Claims 1-7, 
9, 1 1-30 are pending for consideration. 

Response to Arguments 
Applicant's arguments filed on May 26, 2006 have been fully considered but they are not 
persuasive because of the following reasons: 

Regarding Claims 1-7, 9, 1 1-30 applicants argued that the cited prior art (CPA) [Chess et al. 
(U.S. Patent No. 5,485,575), and Chandnani U. S. Pub. 2002/0073330] does not teach, the 
subject matter as claimed. 

Regarding Claims 5,8-9, 15-20, and 25-30 applicant argued that Chess does not teach steps of 
receiving a portion. . . containing a computer virus, parsing the portion. . . using a parser, 
generating a language-independent. . . of the tokens, thee language independent representation. . . 
of the key action, and storing the language. . . as a virus signature, and also argued that it does not 
teach extracting, linearizing, determining and storing set of minimum key action,. 
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Regarding Claims 1-4, 1 1-14, and 21-24, applicant also argued that in Chandnani there is 
no other processing performed upon the tokens and no further representation of the tokens is 
produced, and Chandnani does not teach or suggest generating a language-independent 
representation of the interpreted language source code to be scanned for a virus. 

This is not found persuasive. Chess clearly teaches system and method of automatic 
computer virus verification and removal method that involves obtaining generalized description 
of original and new data sample pairs with transformation finding invariant regions in samples 
for restoration. The method involves obtaining a set of "sample pairs", each consisting of 
transformed and corresponding untransformed data samples. One or more fragments of each 
original data sample within a transformed sample are located. This allows a generalized 
description to be obtained, applicable to each of the sample pairs of locations of fragments of 
each original data sample, and locations of new data regions added by the function-preserving 
transformation that applies to each of the sample pairs. New data regions added by the function- 
preserving transformation are matched across different samples to obtain a description of 
portions of the new data regions that are "invariant" across different samples. Within other, 
variable portions of the new data regions any data from an original data sample embedded there 
are located. A prescription for verifying with high confidence that any given data sample has 
resulted from an application of the function-preserving transformation is generated. A 
prescription for restoring a data sample that has been transformed by the function-preserving 
transformation to a form functionally equivalent to that prior to the transformation is also 
generated. Thus the system of Chess provides sufficiently detailed characterization of virus to 
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allow anti-virus software to detect and remove virus (col.4 line 38 to col.5 line 2 and colli line 
39 to line 56). 

The system of Chandnani on the other hand teaches a script language virus detection method in 
computer system, involves lexically analyzing data stream using prepared language description 
data and detection data. Detection data including test corresponding to a pattern match or a 
cyclical redundancy check is prepared. A data stream is analyzed lexically using the detection 
data and prepared language description data corresponding to a script language, to detect viral 
code (paragraph 0029, 0020, 0016, 0051-0056, and 0064). 

As a result, cited prior art does implement and teach a system and method that relates to 
scanning computer code for viruses and for providing results pertaining to the viruses found by 
scanning of interpreted language viruses, such as scripting viruses. 

Applicants still have failed to identify specific claim limitations, which would define a 
patentable distinction over prior arts. 

The examiner is not trying to teach the invention but is merely trying to interpret the claim 
language in its broadest and reasonable meaning. The examiner will not interpret to read 
narrowly the claim language to read exactly from the specification, but will interpret the claim 
language in the broadest reasonable interpretation in view of the specification. Therefore, the 
examiner asserts that cited prior art(s) does teach or suggest the subject matter recited in 
independent and dependent claims. Accordingly, rejections for claims 1-7, 9, 1 1-30 are 
respectfully maintained. 
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Claim Rejections - 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

1. Claims 5, 7-10, 15-20, 25-30 are rejected under 35 U.S.C. 102(b) as being anticipated by 
Chess et al. (U.S. Patent 5,485,575). 

With respect to claim 5, Chess et al. disclose a method for generating a virus signature using a 
virus scan engine, the method comprising': 

Receiving a portion of interpreted language source code containing a computer virus 
(column 4, lines 38-39); 

parsing the portion of interpreted language source code into tokens using a parser 
(column 11, lines 47-49); inputting at least a portion of the tokens into a threadizor and 

Generating the language-independent representation of the computer virus using at least a 
portion of the tokens (column 11, lines 47-49, lines 55-58). 

Generating a language-independent representation of the computer virus from said 
portion of the tokens using said threadizor (column 11, lines 55-58); wherein the language 
independent representation is a linearized string of key actions (column 12, lines 43-45); and 

Storing the language-independent representation of the computer virus as a virus 
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signature (column 11, lines 55-58). 

2. With respect to claim 7, Chess et al. disclose a method wherein the virus signature is compiled 
in binary format (column 17, lines 15-20). 

3. With respect to claim 9, Chess et al disclose a method, wherein the virus signature includes 
input from a virus analyst (column 11, lines 39-56). 

4. With respect to claim 15, Chess et al. disclose a method f using a virus scan engine or 
generating a virus signature from a portion of interpreted language source code including a 
computer virus, the method comprising: 

Receiving a portion of interpreted language source code containing a computer virus 
(column 4, lines 38-39), 

Parsing the portion of the interpreted language source code containing the computer virus 
into tokens to generate tokenized source code using a parser, wherein at least some of the tokens 
represent key 

actions (column 11, lines 47-49); 

Extracting key actions from the tokenized source code (column 11, lines 47-49), 
Linearizing the key actions to generate an executing thread using a threadizor (column 5, 

lines 43-45); 

Determining the set of minimum key actions in the executing thread required to effect the 
computer virus (column 11, lines 55-58); and 
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Storing the set of minimum key actions as a virus signature (column 11, lines 55-58). 

6. With respect to claim 16, Chess et al. disclose a method, further comprising: 
Compiling the virus signature in binary format (column 17, lines 15-20). 

7. With respect to claim 17, Chess et al. disclose a method, further comprising; 

Compiling the virus signature with data input by a virus analyst (column 11, lines 39-56); 

and 

Storing the virus signature as part of a virus pattern file (column 17, line 20). 

8. With respect to claim 18, Chess et al. disclose a method, wherein the virus pattern file 
further includes a dictionary of key actions (column 17, line 20; column 11, lines 55-58; Each 
signature consists of key actions.). 

9. With respect to claim 19, Chess et al. disclose a method, wherein the portion of the 
interpreted language source code is lexically parsed (column 13, line 9-10). 

10. With respect to claim 20, Chess et al. disclose a method, wherein the portion of the 
interpreted language source code is lexically and grammatically parsed (column 13, line 9-10; 
column 11, lines 60-64). 

11. With respect to claim 25, Chess et al. disclose a computer readable medium containing 
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program code using a virus scan engine (column 4, lines 5-7, 16-18) for generating a virus 
signature from a portion of interpreted language source code including a computer virus, the 
computer readable medium comprising instructions for: 

Receiving a portion of interpreted language source code containing a computer virus 
(column 4, lines 38-39); 

Parsing the portion of the interpreted language source code containing the computer virus 
into tokens to generate tokenized source code using a parser, wherein at least some of the tokens 
represent key actions (column 11, lines 47-49), 

Linearizing at least a portion of the key actions to generate an executing thread using a 
threadizor (column 12, lines 43-45); 

Determining the set of minimum key actions in the executing thread required to effect the 
computer virus (column 11, lines 55-58); and 

Storing the set of minimum key actions as a virus signature (column 11, lines 55-58). 

12. With respect to claim 26, Chess et al. disclose a computer readable medium, further 
comprising: 

Compiling the virus signature in binary format (column 17, lines 15-2%. 

13. With respect to claim 27, Chess et al. disclose a computer readable medium, further 
comprising: 

Compiling the virus signature with data input by a virus analyst (column 11, lines 39-56); 

and 
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Storing the virus signature as part of a virus pattern file (column 17, line 20). 

14. With respect to claim 28, Chess et al. disclose a computer readable medium, wherein the 
virus pattern file further includes a dictionary of key actions (column 17, line 20, column 11, 
lines 55-58; Each signature consists of key actions.). 

15. With respect to claim 29, Chess et al. disclose a computer readable medium, wherein the 
portion of the interpreted language source code is lexically parsed (column 13, line 9-10). 

16. With respect to claim 30, Chess et al. disclose a computer readable medium, wherein the 
portion of the interpreted language source code is lexically and grammatically parsed (column 
13, line 9-10; column 11, lines 60-64). 



17. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 



18. Claims 1-4, 1 1-14, 21-24 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Chandnani et al. (U.S. Publication 2002/0073330). 
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19. With respect to claim 1, Chandnani et al. disclose a method for identifying a computer 
virus in interpreted language source code using a virus scan engine, the method comprising: 

Receiving a portion of interpreted language source code (paragraph 0029, lines 4-5); 
Generating a language-independent representation of the portion of the interpreted 
language source code (Paragraph 0020, lines 1-2); 

Comparing the language-independent representation with a virus signature in a pattern 
matcher (paragraph 0064, paragraph 0051-0056); and 

Determining if the language-independent representation matches the virus signature, 
whereby a match indicates a computer virus has been identified (paragraph 0064). 

20. With respect to claim 2, Chandnani et al. disclose a method, wherein the interpreted language 
source code is a scripting language source code (paragraph 0016, lines 1-2). 

21. With respect to claim 3, Chandnani et al. disclose a method, wherein the virus signature is a 
language-independent representation of an interpreted language source code computer virus 
(paragraph 0055). 

22. With respect to claim 4, Chandnani et al. disclose a method, wherein the portion of 
interpreted language source code and the virus signature are represented as a linearized string of 
key actions (paragraph 0055). 
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23. With respect to claim 11, Chandnani et al. disclose a method (paragraph 0029, line 2) for 
identifying a virus in interpreted language source code using a virus scan engine, the method 
comprising: 

Receiving a portion of interpreted language source code (paragraph 0029, lines 4-5); 

Parsing the portion of the interpreted language source code into tokens to generate a 
tokenized source code using a parser, wherein at least some of the tokens represent key actions 
(paragraph 0020, lines 1-2)) 

Extracting selected key actions from the tokenized source code (paragraph 0020, lines 2- 

3), 

Linearizing the key actions to generate an executing thread (paragraph 0020, lines 3-5); 
Comparing the executing thread with a virus signature of a known virus in a pattern 
matcher (paragraph 0064, and paragraph 0051-0056); and 

Determining whether the executing thread matches the virus signature (paragraph 0064). 

24. With respect to claim 21, Chandnani et al. disclose a computer readable medium (paragraph 
0066, lines 1-5) containing program code for identifying a computer virus in interpreted 
language source code using a virus scan engine, the computer readable medium comprising 
instructions for: 

Receiving a portion of interpreted language source code (paragraph 0029, lines 4-5); 

Parsing the portion of the interpreted language source code into tokens to generate a 
tokenized source code using a parser, wherein at least some of the tokens represent key actions 
(paragraph 0020, lines 1-2); 
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Extracting selected key actions from the tokenized source code (paragraph 0020, lines 2- 

3), 

Linearizing the key actions to generate an executing thread (paragraph 0020, lines 3-5); 
Comparing the executing thread with a virus signature of a known virus in a pattern 
matcher (paragraph 0064, and paragraph 0051-0056); and 

Determining whether the executing thread matches the virus signature (paragraph 0064). 

25. With respect to claims 12 and 22, Chandnani et al. disclose a method and medium, further 
comprising: 

Outputting the identification of the known virus (paragraph 0055, lines 9- 13; paragraph 
0063, lines 12-15). 

26. With respect to claims 13 and 23, Chandnani et al. disclose a method and medium, wherein 
the portion of the interpreted language source code is lexically parsed (paragraph 0016, lines 8- 
10). 

27. With respect to claim 14 and 24, Chandnani et al. disclose a method and medium, wherein 
the portion of the interpreted language source code is lexically and grammatically parsed 
(paragraph 0017). 



Claim Rejections - 35 USC § 103 
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The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 
rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

28. Claim 6 is rejected under 35 U.S.C. 103(a) as being unpatentable over Chess et al. (U.S. 
Patent 5,485,575) in view of Chandnani et al. (U.S. Publication 2002/0073330). 

29. Chess et al and Chandnani et al. are analogous art because both are in the field of computer 
security. • 

30. With respect to claim 6, Chess et al. disclose the limitations set forth in claim 5, upon which 
claim 6 is dependent. 

31. Chess et al. do not disclose a method wherein the interpreted language source code is a 
scripting language source code. 

Chandnani et al. disclose a method wherein the interpreted language source code is a scripting 
language source code (paragraphe 0016, lines 1-2). 

32. It would have been obvious to one of ordinary skill in the art to combine the teachings 
of Chandnani et al. with the teachings of Chess et al. in order to prevent potentially terrible 
problems with a computer system or operating system (paragraph 0005). 
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Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Syed Zia whose telephone number is 571-272-3798. The 
examiner can normally be reached on 9:00 to 5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 571-272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



August 08, 2006 



sz 




